Vulnerability details
CVE-2026-54299
withastro astro
Astro: Host-header full-read SSRF in core prerendered error-page fetch (prerenderedErrorPageFetch default + unvalidated createRequestFromNodeRequest URL)
CVSS 3.1
7.5High
Official description
Astro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from request.url, which in turn gets its origin from the incoming Host header. When the Host header is not validated against allowedDomains, an attacker can point the fetch at an arbitrary host and read the response. This vulnerability is fixed in 6.4.6.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| withastro | astro | < 6.4.6 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://github.com/withastro/astro/security/advisories/GHSA-2pvr-wf23-7pc7 x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-06-22
- Last updated
- 2026-06-23
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.33%
Probability of exploitation in 30 days
26.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-20Improper Input Validation
- CWE-918Server-Side Request Forgery (SSRF)